Password Strength Checker

Estimating how guessable a password is

A strength checker approximates how much work an attacker needs to guess your password. It does this by estimating entropy, measured in bits: each additional bit doubles the number of guesses required. The estimate combines the length and the variety of characters, then penalizes predictable structure the raw math would miss.

Entropy is not the whole story

Naive entropy assumes every character is random, but humans are not random. P@ssw0rd1 looks mixed-case with symbols and digits, yet it follows a pattern attackers model directly, so its real strength is far below the naive estimate. Good checkers (the zxcvbn approach) score against dictionaries, keyboard walks, dates, and common substitutions rather than just counting character classes.

Example

"hunter2"            ~ 12 bits   cracked instantly
"P@ssw0rd1"          naive ~52,  real ~15 bits
"glider-mantis-cove" ~60 bits    strong passphrase

The passphrase wins because length multiplies the search space faster than squeezing in symbols does, and random words dodge the dictionary penalties that sink leetspeak.

Why run it locally

A password is only safe if it never leaves your control. A checker that scores entirely in the browser avoids ever sending the candidate over the network, so there is no server log, no transit, nothing to leak. A strong generator pairs well here (see the password generator).

FAQ

Does a green bar mean my password is safe? It means it resists common guessing models. It cannot know if that exact string has already appeared in a breach, which is a separate check against known leaked lists.

Why does adding a symbol barely move the score? Because length dominates. Appending two more random characters usually helps more than swapping one letter for a symbol.